Overview of DNS Privacy and Encryption Technologies
Several technologies aim to improve DNS privacy and prevent interception:
- DNS over HTTPS/TLS/QUIC: Encrypts communication between the client and the recursive resolver to prevent tampering and eavesdropping.
- Oblivious DNS over HTTPS (ODoH): Adds a proxy between the client and the resolver to hide the client's IP address.
- Encrypted SNI (ENSI) / Encrypted Client Hello (ECH): Encrypts the Server Name Indication (SNI) field in the TLS handshake, which previously leaked the destination domain name in plaintext.